Privacy policy

This document covers the SemySMS service - the website, the API and the gateway app - and our SemySMS Connect app on Google Play. SemySMS Connect has no account, so most of this document does not apply to it: everything about it is in section 9, and how to delete your data is in section 10.

SemySMS turns your Android phone into an SMS gateway. We are not the ones sending your messages: the app receives a job from the server, and the text itself leaves your SIM card, through your carrier, from your number. We are not a carrier and not the sender - we pass the job to a phone you linked to your account yourself.

Everything else in this document follows from that, so let us state up front what the service needs in order to work:

• it needs to know who owns the account, or the job would go to someone else's phone;
• it needs to store messages, or you would not see what was sent and what was not;
• it needs to know the state of the linked phone - whether it is online, which carrier, how much battery is left - or there would be no way to show why a message did not go out.

Everything listed below is collected for exactly that. We do not build advertising profiles, we do not sell user data, and we do not hand it to anyone except in the cases described in section 7.

Account. Your email address - which is also your login - password, time zone, interface language, and the dates of registration and last sign-in. First and last name are optional; the service works without them. The password is stored as an irreversible hash: it is not in the database in readable form, and we cannot see it.

Linked phones. Device name and model, manufacturer, Android version, app version, carrier, SIM card number (if the app was able to detect it), battery level, time of last activity, and the limits you set. All of it is shown to you on the Devices page: it is what tells you whether a phone is ready to send.

Messages. For outgoing messages - the recipient's number, the text, the time, the delivery status, and the IP address the send request came from. For incoming ones - the sender's number, the text and the time. If you enabled forwarding of incoming calls, the number and time of the call are stored; the call itself is not recorded - the app technically cannot do that.

Contacts. Only the ones you added to the service yourself: by hand, by importing from Excel or from text, or by exporting your phone book. That is the number, first name, last name, middle name, email, birthday and a note. Your phone book is never uploaded on its own - that is a separate action, and you are the one who takes it.

Payments. We store the fact of payment, the amount and the invoice number. Card details are entered on the payment provider's side and never reach us: we neither see nor store them.

The app declares a fairly long list of Android permissions in its manifest. That does not mean you will have granted all of them: permissions are granted by you, one at a time, and you do not have to grant them all.

Required - sending and reading SMS, and access to phone functions (which SIM card is installed, which carrier, whether there is a network). Without those the service is pointless: there would be nothing to send messages with, and nothing to explain a failed send from.

Everything else is optional. Each one covers a single feature and is asked for when you use that feature. Access to your phone book is needed only to upload contacts into the service. The call log - only to show incoming calls. Deny one and only that feature stops working; the rest keeps running.

Any permission can be revoked in Android settings without uninstalling the app. A phone can be unlinked from the account with one button - either in the app or on the Devices page in your account.

We do not keep messages longer than the service needs them. They are deleted automatically, on a schedule, without your involvement and with no way to restore them:

• Incoming messages and calls - after 3 months.
• Sent messages - after 5 months. If you unlinked a phone from your account, its messages are deleted after 2 months.
• Campaigns - archived 2 months after creation, then deleted along with their messages.
• API token statistics - up to a month.

These are upper bounds, not a promise to keep anything: any message can be deleted in your account or through the API at any time, and it will be gone sooner.

Account data - email, language, time zone - lives as long as the account does. Contacts live as long as you use them; what happens to an abandoned account is described in the next section.

If nobody has signed in to an account for more than 6 months and no linked phone has been in touch during that time, the service treats the account as abandoned and deletes its contacts - the most sensitive thing left in it by then. Messages are already gone at that point under the rules in section 4.

Both conditions have to hold. An account you have not signed in to for six months, whose phone stayed online and kept sending through the API, does not count as abandoned.

The account itself is kept: you will be able to sign in with your email and carry on, but the contact list will be empty, and we will not be able to restore it. If you no longer need the account, do not wait six months - write to us, see section 8.

Messages leave your phone, through your SIM card, from your number. A SIM card is registered to a specific person, and to the recipient, to the carrier and to the law that person is the sender - not SemySMS.

So the account and phone owner is responsible for what gets sent:

• for the text of the message - we neither write it, nor edit it, nor review it;
• for who it is sent to, and for the recipient having consented to such messages;
• for complying with advertising, personal data and telecom law in the recipient's country;
• for what the carrier charges: messages are billed by them, on your plan, not by us.

The service does not moderate texts and does not decide which messages may be sent and which may not. That is not liability disclaimed after the fact but a consequence of how it is built: the service hands a job to your phone and shows you the result - there is no point in that chain where we could step into the content.

The practical consequence: if someone complains about your messages, or a carrier blocks the number, it is the number's owner who will have to sort it out - it is their number and their contract with the carrier. An account used for spam or fraud we can and do block, but restoring a number's reputation is not in our power.

The service does not run in a vacuum, and some data inevitably passes through other people's hands:

• Your carrier - whoever's SIM card is in your phone. They see the number, the text and the time of every message: they are the ones delivering it. That is not our choice, it is how cellular networks work.
• Google - Firebase Cloud Messaging wakes the app on your phone, reCAPTCHA protects the sign-in and sign-up forms from bots, Google Analytics counts site visits, and Firebase Analytics and Crashlytics collect statistics and crash reports from the SemySMS Connect app (section 9). Signing in with a Google account passes us nothing but your email address.
• Payment providers - they receive the amount and the invoice number when you pay for premium. What they do with your card details is covered by their own policies.

The site uses cookies for three things: remembering that you are signed in, which language you picked, and which theme - light or dark. Google Analytics sets cookies of its own, and Google's policy applies to those. There are no ad networks tracking you across other sites anywhere on the service.

You can delete your data yourself, without asking us. Messages and contacts are deleted in your account and through the API. A phone is unlinked from the account with one button - in the app or on the Devices page; once unlinked, its messages are deleted after 2 months.

To delete the account entirely, write to admin@semysms.net from the address the account is registered to. That is the only way we can tell the request came from the account owner.

Changes to this policy. If we change this document, the new version appears on this page and the date at the top changes. We will not notify every user separately, so check back here if this matters to you.

Questions - admin@semysms.net.

SemySMS Connect is our calls and SMS app on Google Play. You can set it as your default phone and SMS app. It has no account, and it does not send your messages, calls or phone book to our servers.

What the app uses on your phone. All of this is processed on the phone itself and is needed only for the app to work:

• SMS and MMS - to show conversations and to send and receive messages;
• calls and the call log - to make and answer calls, show call history and block numbers on your blocklist;
• contacts - to show names instead of numbers, and to search, create, edit and delete contacts;
• SIM card details - to choose the SIM for a call or a message and to show the carrier;
• notifications - to tell you about new messages and incoming calls.

SMS, the call log and contacts are stored by Android itself, not by the app. The app itself keeps only its settings and the numbers on your blocklist and allowlist.

What leaves the phone:

• Messages and calls - through your carrier, as with any phone app.
• Contacts you save in the app. The name, phone number and email are written to your phone's address book, into the account you keep your contacts in - usually Google. It is that account that uploads them to its cloud when it syncs your contacts.
• Statistics and crash reports. The app uses Google Firebase Analytics and Firebase Crashlytics. They send the app installation ID and the advertising ID, which screens were opened and how long sessions lasted, and technical details of a crash. They contain no names, phone numbers or message texts. We use them to find bugs and to see which features people use.
• A phone number to WhatsApp - only when you choose WhatsApp yourself in the call log.

Who data is shared with. We do not sell data and do not use it for advertising. Statistics and crash reports are processed by Google on our behalf. The app passes message and call details to other apps on the phone only when you do it yourself - for example, when you share a message - or to our own apps signed with the same developer key.

How data is protected. Statistics and crash reports are sent over an encrypted connection. Everything else stays on the phone under the protection of Android itself: only apps you have allowed can access your messages, calls and contacts.

How to delete your data and how long it is kept - see section 10.

You can delete your data by email - no account or sign-in needed:

1. Email admin@semysms.net with the subject "SemySMS Connect data deletion".
2. Include your phone model and the approximate date you installed the app. Statistics contain no name, phone number or email, so these are the only details we can find your records by.
3. Within 30 days we delete your records and reply to your email.

What is deleted and when:

• Usage statistics (Google Firebase Analytics) - on your request, within 30 days; Google erases them from its systems completely within a further 63 days. Without a request, statistics are deleted automatically after 14 months at most.
• Crash reports (Firebase Crashlytics) - automatically, after 90 days.
• App settings and call filter lists - immediately, when you uninstall the app. Statistics collection stops at the same time.
• Contacts you saved through the app - when you delete them from your address book: that is where they are stored, not with us.

What stays: the messages, call log and contacts on your phone. They are stored by Android, not by the app, so uninstalling the app does not affect them.